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Chairman Larsen, Ranking Member Graves, Members of the Subcommittee: 

Thank you for the opportunity to appear before you today to discuss aviation safety and 
the issues surrounding the Boeing 737 MAX. On behalf of the United States Department of 
Transportation and the Federal Aviation Administration, we would like to take this opportunity 
to, once again, extend our deepest sympathy to the families of the victims of the Ethiopian 
Airlines and Lion Air accidents. 

Safety is the core of the Federal Aviation Administration’s mission and our top priority. 
With the support of this Committee, we have worked tirelessly to take a more proactive, data- 
driven approach to oversight that prioritizes safety above all else inside the FAA and within the 
aviation community that we regulate. The result of this approach is that the United States has the 
safest air transportation system in the world. Since 1997, the risk of a fatal commercial aviation 
accident in the United States has been cut by 94 percent. And in the past ten years, there has 
been one commercial airline passenger fatality in the United States in over 90 million flights. 

But, one fatality is one too many, and a healthy safety culture requires commitment to 
continuous improvement. 

Our commitment to safety and fact-based, data-driven decision making has been the 
guiding principle in the FAA’s response to the two fatal accidents involving the Boeing 737 
MAX airplane outside the United States. Today, I would l ik e to provide you with an overview 



of the FAA’s certification and oversight processes, our current actions with respect to the 737 
MAX, and the steps that the FAA is taking to foster safety enhancements here and abroad. 

The FAA is a Data-Driven Agency Focused on Safety 

As the aerospace system and its components become increasingly more complex, we 
know that our oversight approach needs to evolve to ensure that the FAA remains the global 
leader in achieving aviation safety. In order to maintain the safest air transportation system in 
the world, during the past two decades the FAA has been evolving from a prescriptive and more 
reactive approach for its safety oversight responsibilities to one that is performance-based, 
proactive, centered on managing risk, and focused on continuous improvement. A key part of 
this transition has been the adoption of safety management systems, or SMS, within the FAA. 
The evolution toward SMS began internally at the FAA more than 15 years ago, starting with the 
FAA’s Air Traffic Organization and expanding across the FAA to include all of our lines of 
business. Consistent with recommendations of the International Civil Aviation Organization 
(ICAO), we have been working towards implementation of SMS in various sectors. For 
example, as of March 9, 2018, scheduled commercial air carriers, regulated under 14 CFR part 
121, are required to have an SMS. 

Safety is not just a set of programs that can be “established” or “implemented.” It is a 
way of living and working, and it requires the open and transparent exchange of information. 

We know that it takes collaboration, communication, and common safety objectives to allow the 
FAA and the aviation community to come together, to identify system hazards, and to implement 
safety solutions. This approach gives us knowledge that we would not otherwise have about 
events and risks. Sharing safety issues, trends, and lessons learned is critical to recognizing 
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whatever might be emerging as a risk in the system. The more data we have, the more we can 
learn about the system, which in turn allows us to better manage and improve the system. 

To be clear, the SMS approach does not diminish the FAA’s role as a safety regulator. 
Any party that the FAA regulates remains responsible for compliance with the FAA’s regulatory 
standards, and the FAA does not hesitate to take enforcement action when it is warranted. 

Aircraft Certification 

Information sharing is a cornerstone of aviation safety and has significantly contributed 
to the United States’ outstanding safety record. One of the FAA’s core functions, aircraft 
certification, has always relied on the exchange of information and technical data. The FAA 
certifies the design of aircraft and components that are used in civil aviation operations. Some 
version of our certification process has been in place and served us well for over 60 years. This 
does not mean the process has remained static. To the contrary, since 1964, the regulations 
covering certification processes have been under constant review. As a result, the general 
regulations have been modified over 90 times, and the rules applicable to large transport aircraft, 
like the Boeing 737 MAX, have been amended over 130 times. The regulations and our policies 
have evolved in order to adapt to an ever-changing industry that uses global partnerships to 
develop new, more efficient, and safer aviation products and technologies. What has not 
changed is that, for any new project, the FAA identifies all safety standards and makes all key 
decisions regarding certification of the aircraft. 

The FAA focuses its efforts on areas that present the highest risk within the system. The 
FAA reviews the applicant’s design descriptions and project plans, determines where FAA 
involvement will derive the most safety benefit, and coordinates its intentions with the applicant. 
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When a particular decision or event is critical to the safety of the product or to the determination 
of compliance, the FAA is involved either directly or through the use of our designee system. 

The use of designation, in some form, has been a vital part of our safety system since the 
1920s. Congress has continually expanded the designee program since creation of the FAA in 
1958, and it is critical to the success and effectiveness of the certification process. Under this 
program, the FAA may delegate a matter related to aircraft certification to a qualified private 
person. This is not self-certification; the FAA retains strict oversight authority. The program 
allows the FAA to leverage its resources and technical expertise while holding the applicant 
accountable for compliance. During the past few years, Congress has endorsed FAA’s 
delegation authority, including in the FAA Reauthorization Act of 2018, which directed the FAA 
to delegate more certification tasks to the designees we oversee. 

In aircraft certification, both individual and organizational designees support the FAA. 

The FAA determines the level of involvement of the designees and the level of FAA 
participation needed based on many variables. These variables include the designee’s 
understanding of the compliance policy; consideration of any novel or unusual certification 
areas; or instances where adequate standards may not be in place. 

The Organization Designation Authorization (ODA) program is the means by which the 
FAA may authorize an organization to act as a representative of the FAA under strict FAA 
oversight. Currently, there are 79 ODA holders. ODA certification processes allow FAA to 
leverage industry expertise in the conduct of the certification activities and focus on important 
safety matters. The FAA has a rigorous process for issuing an ODA and only grants this 
authorization to mature companies with a proven history of designing products that meet FAA 
safety standards. ODA holders must have demonstrated experience and expertise in FAA 
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certification processes, a qualified staff, and an FAA-approved procedures manual before they 
are appointed. The FAA delegates authority on a project-by-project basis, and the manual 
defines the process and procedures to which the ODA must adhere when executing the delegated 
authority. The ODA holder is responsible to ensure that ODA staff are free to perform their 
authorized functions without conflicts of interest or undue pressure. 

There are many issues that will always require direct FAA involvement, including 
equivalent level of safety determinations, and rulemakings required to approve special 
conditions. The FAA may choose to be involved in other project areas after considering factors 
such as our confidence in the applicant, the applicant’s experience, the applicant’s internal 
processes, and confidence in the designees. 

Something that is not well understood about the certification process is that it is the 
applicant’s responsibility to ensure that an aircraft complies with FAA safety regulations. It is 
the applicant who is required to develop aircraft design plans and specifications, and perform the 
appropriate inspections and tests necessary to establish that an aircraft design complies with the 
regulations. The FAA is responsible for determining that the applicant has shown that the 
overall design meets the safety standards. We do that by reviewing data and by conducting risk- 
based evaluations of the applicant's work. 

The FAA is directly involved in the testing and certification of new and novel features 
and technologies. When a new design, or a change to an existing design, of an aircraft is being 
proposed, the designer must apply to the FAA for a design approval. While an applicant usually 
works on its design before discussing it with the FAA, we encourage collaborative discussions 
well in advance of presenting a formal application. Once an applicant informs the FAA of the 
intent to develop and certify a product, a series of meetings are held both to familiarize the FAA 
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with the proposed design, and to familiarize the applicant with the certification requirements. A 
number of formal and informal meetings are held on issues ranging from technical to procedural. 
Once the application is made, issue papers are developed to provide a structured way of 
documenting the resolution of technical, regulatory, and administrative issues that are identified 
during the process. 

Once the certification basis is established for a proposed design, the FAA and the 
applicant develop and agree to a certification plan and initial schedule. In order to receive a type 
certificate, the applicant must conduct an extensive series of tests and reviews to show that the 
product is compliant with existing standards and any special conditions, including lab tests, flight 
tests, and conformity inspections. These analyses, tests, and inspections happen at a component- 
level and an airplane-level, all of which are subject to FAA oversight. If the FAA finds that a 
proposed new type of aircraft complies with safety standards, it issues a type certificate. Or, in 
the case of a change to an existing aircraft design, the FAA issues an amended type certificate. 

Facts Concerning the Boeing 737 MAX 

While the FAA is always striving to improve safety, the certification processes described 
above are extensive, well-established, and have consistently produced safe aircraft designs for 
decades. The Boeing Company has designed and built 14 variations of its original model 737 
since the FAA issued the original type certificate in 1967. Following standard certification 
procedures, and based on the information Boeing provided, the FAA determined in February 
2012 that the 737 MAX qualified as an amended type certificate project eligible for management 
by the Boeing ODA. The formal application was submitted in June 2012. Under such an 
arrangement, FAA subject matter experts are directly involved in safety related aspects of the 
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project. For example, the FAA was directly involved in the System Safety Review of the 
Maneuvering Characteristics Augmentation System (MCAS). 

The process from initial application to final certification took five years; the 737 MAX 
was certified in March 2017. The process included 297 certification flight tests, some of which 
encompassed tests of the MCAS functions. FAA engineers and flight test pilots were involved in 
the MCAS operational evaluation flight test. During the FAA’s continued oversight of 
airworthiness standards, as we obtain pertinent information, identify potential risk, or learn of a 
system failure, we analyze it, mitigate the risk, update the certification requirements and require 
operators to implement the mitigation. 

737 MAX Accidents and the Decision to Ground the Fleet 

On October 29, 2018, a Boeing 737 MAX 8 operated by Lion Air as flight JT610 crashed 
after taking off from Soekarno-Hatta Airport in Jakarta, Indonesia. Flight JT610 departed from 
Jakarta with an intended destination of Pangkal Pinang, Indonesia. It departed Jakarta at 6:20 
a.m. (local time), and crashed into the Java Sea approximately 13 minutes later. One hundred 
and eighty-four passengers and five crewmembers were on board. There were no survivors. An 
Indonesian-led investigation into the cause of this accident is ongoing, supported by the National 
Transportation Safety Board (NTSB), FAA, and Boeing. A preliminary report prepared by the 
Indonesian National Transportation Safety Committee was released in November 2018. 

On November 7, 2018, based on all available and relevant information, including 
evidence from the Lion Air accident investigation and analysis performed by Boeing, the FAA 
issued an Emergency Airworthiness Directive. The airworthiness directive requires operators of 
the 737 MAX to revise their flight manuals to reinforce and emphasize to flight crews how to 
recognize and respond to uncommanded stabilizer trim movement and MCAS events. The FAA 
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continued to evaluate the need for software and/or other design changes to the aircraft including 
operating procedures and training as additional information was received from the ongoing Lion 
Air accident investigation. On January 21, 2019, Boeing submitted a proposed plan for an 
MCAS software enhancement to the FAA for certification. To date, the FAA has tested a 
prototype of this enhancement to the 737 MAX flight control system in both the simulator and 
the aircraft. FAA flight test engineers and flight test pilots performed a preliminary evaluation of 
the prototype which included aerodynamic stall situations and recovery procedures. 

On March 10, 2019, Ethiopian Airlines flight ET302, also a Boeing 737 MAX 8, crashed 
at 8:44 a.m. (local time), six minutes after takeoff. The flight departed from Bole International 
Airport in Addis Ababa, Ethiopia with an intended destination of Nairobi, Kenya. The accident 
site is near Bishoftu, Ethiopia. One hundred and forty-nine passengers and eight crewmembers 
were on board. None survived. An Ethiopian-led investigation into the cause of this accident is 
ongoing, supported by the NTSB, FAA, and Boeing. A preliminary report prepared by the 
Aircraft Accident Investigation Bureau of Ethiopia was released in April 2019. 

Following the second accident, the FAA gathered all of the data it had regarding 737 
MAX operations in the United States and continued to review information from the investigation 
as it became available. On March 11, 2019, the FAA issued a Continuous Airworthiness 
Notification to the International Community (CANIC) for 737 MAX operators. The CANIC 
included a list of all of the activities the FAA had completed in support of the continued 
operational safety of the 737 MAX fleet. These activities included the airworthiness directive 
issued on November 7, 2018, ongoing oversight of Boeing’s flight control system enhancements, 
and updated training requirements and flight crew manuals. 
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After issuing the CANIC, the FAA continued to evaluate all available data and aggregate 
safety performance from operators and pilots of the 737 MAX, none of which provided any data 
to support grounding the aircraft. Also, at that time, other civil aviation authorities had not 
provided any data to the FAA that warranted action. The FAA’s initial review of flight safety 
data for U.S. operators showed no systemic performance issues and provided no basis to order 
grounding the aircraft. 

On March 13, 2019, however, the Ethiopian Airlines investigation developed new 
information from the wreckage concerning the aircraft’s configuration just after takeoff that, 
taken together with newly refined data from satellite-based tracking of the aircraft’s flight path, 
indicated some similarities between the Ethiopian Airlines and Lion Air accidents that warranted 
further investigation of the possibility of a shared cause that needed to be better understood and 
addressed. Accordingly, the FAA made the decision to ground all 737 MAX airplanes operated 
by U.S. airlines or in U.S. territory pending further investigation, including examination of 
information from the aircraft’s flight data recorders and cockpit voice recorders. 

Post-Grounding Actions 

On March 19, 2019, Secretary Chao asked the U.S. Department of Transportation’s 
Inspector General to conduct an audit of the certification for the Boeing 737 MAX 8, with the 
goal specifically to compile an objective and detailed factual history of the activities that resulted 
in the certification of the Boeing 737 MAX 8 aircraft. That audit is ongoing, with the 
cooperation of the FAA. 

On March 20, 2019, the FAA issued a second CANIC with updated information for 
operators of the 737 MAX. Specifically, the CANIC notified operators that Boeing had begun 
work on a Service Bulletin that would specify the installation of new flight control computer 


9 



operational program software and had developed flightcrew training related to this software. 
Boeing is still to submit the final software package for certification. The FAA’s ongoing review 
of this software installation and training is an agency priority, as will be the roll-out of any 
software, training, or other measures to operators of the 737 MAX. 

On March 25, 2019, Secretary Chao announced the establishment of a Special Committee 
to review the FAA’s procedures for the certification of new aircraft, including the Boeing 737 
MAX. The Special Committee to Review FAA’s Aircraft Certification Process is an 
independent body whose findings and recommendations will be presented directly to the 
Secretary and the FAA Administrator. The Special Committee is formed within the structure of 
the Safety Oversight and Certification Advisory Committee (SOCAC) created by section 202 of 
the FAA Reauthorization Act of 2018. 

Further, on April 2, 2019, the FAA announced it was establishing a Joint Authorities 
Technical Review (JATR) to conduct a comprehensive review of the certification of the 
automated flight control system on the Boeing 737 MAX. The JATR is chaired by former NTSB 
Chairman Christopher Hart and comprises a team of experts from the FAA, National Aeronautics 
and Space Administration (NASA), and the aviation authorities of Australia, Brazil, Canada, 
China, the European Union, Indonesia, Japan, Singapore, and the United Arab Emirates. On 
April 29, the JATR initiated its review, with members tasked to provide the FAA with their 
findings regarding the adequacy of the certification process and any recommendations to 
improve the process. Completion of the JATR’s work is not a prerequisite for returning the 737 
MAX to service. 

Additionally, on April 12, 2019, the FAA convened a meeting at the agency’s 
Washington, D.C. headquarters with safety representatives of the three U.S.-based commercial 
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airlines that have the Boeing 737 MAX in their fleets, as well as the pilot unions for those 
airlines. The meeting covered three major agenda items: a review of the publicly available 
preliminary findings of the investigations into the Lion Air and Ethiopian Airlines accidents; an 
overview of the anticipated software enhancements to the MCAS system; and, an overview of 
pilot training. Each presentation corresponding to the agenda, delivered by FAA subject matter 
experts, allowed for an open exchange between all participants. This meeting was an 
opportunity for the FAA to hear individual views from operators and pilots of the 737 MAX as 
the agency evaluates what needs to be done before the FAA makes a decision to return the 
aircraft to service in the United States. 

The FAA recently solicited public comment on a draft report prepared by the FAA’s 
Boeing 737 MAX Flight Standardization Board (FSB). The FSB is a panel that FAA utilizes to 
evaluate and determine the sufficiency of proposed training developed by Boeing and related to 
the proposed software enhancements for the 737 MAX aircraft. An FSB is generally comprised 
of qualified pilots from FAA’s Certificate Management Offices, foreign authorities, and industry. 
The FSB report outlines the minimum guidelines for an air carrier training program. The 
comment period on the draft report has been extended multiple times to ensure ample 
opportunity for public input. The FAA will review this input before making a final assessment. 

On May 6, 2019, the FAA initiated a multi-agency Technical Advisory Board (TAB) 
review of the MCAS software update and system safety assessment in order to determine 
sufficiency. The TAB consists of a team of experts from the U.S. Air Force, NASA, Volpe 
National Transportation Systems Center, and the FAA. None of the TAB experts have been 
involved in any aspect of the Boeing 737 MAX certification. The TAB is charged with 
evaluating Boeing and FAA efforts related to the software update and its integration into the 
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flight control system. The TAB will identify issues where further investigation is required prior 
to approval of the design change. Although the JATR is broadly considering certification of the 
flight control systems, the TAB is evaluating the proposed technical solutions. The TAB’s 
recommendations will directly inform the FAA’s decision concerning the 737 MAX fleet’s 
return to service. 

On May 23, 2019, the FAA will host a meeting of Directors General of civil aviation 
authorities from around the world to discuss the FAA’s activities toward ensuring the safe return 
of the 737 MAX to service. This meeting is part of the FAA’s efforts to work with other civil 
aviation authorities to address specific concerns related to the 737 MAX, in keeping with the 
FAA’s longstanding cooperation with its international partners. As recent events have reminded 
us, aviation does not have borders or boundaries. The FAA is focused on continuous safety 
improvement here at home and internationally through our ongoing engagement with other civil 
aviation authorities and industry stakeholders throughout the world. Aviation remains the safest 
mode of transportation in the United States and globally, and we advance this level of safety by 
sharing issues, trends, and lessons learned throughout the world. The United States is the gold 
standard in aviation safety. The FAA is resolute in its commitment to maintaining that standard. 
In our quest for continuous safety improvement, the FAA welcomes external review of our 
systems, processes, and recommendations. And the 737 MAX will return to service for U.S. 
carriers and in U.S. airspace only when the FAA’s analysis of the facts and technical data 
indicate that it is safe to do so. 

This concludes my prepared statement. I will be happy to answer your questions. 
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